{
  "type": "bundle",
  "id": "bundle--99047263-9106-5e74-811f-a57cbea78c5a",
  "objects": [
    {
      "type": "identity",
      "spec_version": "2.1",
      "id": "identity--1a22f60d-2ab2-52fc-8dd6-b175157417ff",
      "created": "2026-08-09T07:53:27Z",
      "modified": "2026-08-09T07:53:27Z",
      "x_ally_original_id": "org:a1df85a2-090e-4114-8e84-1c0cd7fb5792",
      "name": "McGraw Hill",
      "identity_class": "organization"
    },
    {
      "type": "incident",
      "spec_version": "2.1",
      "id": "incident--62af6663-ea12-5488-8a20-5145ded755b4",
      "created": "2026-08-09T07:53:27Z",
      "modified": "2026-08-09T07:53:27Z",
      "x_ally_original_id": "inc:648a9599-a12d-4b65-b504-9c12a00f702e",
      "name": "April 2026 McGraw Hill Salesforce-hosted webpage incident"
    },
    {
      "type": "incident",
      "spec_version": "2.1",
      "id": "incident--b20b8f6e-e4ba-5e8e-8b6b-af7cc545e9e8",
      "created": "2026-08-09T07:53:27Z",
      "modified": "2026-08-09T07:53:27Z",
      "x_ally_original_id": "brh:54ed044f-9e60-47f0-96b8-71ea60231be3",
      "name": "McGraw Hill Salesforce-hosted webpage data exposure"
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--055c1536-256e-5d75-8150-4a84909c5d85",
      "created": "2026-08-09T07:53:27Z",
      "modified": "2026-08-09T07:53:27Z",
      "x_ally_original_id": "clm:4788aeb7-a0f1-4a0e-8a86-f0a7a636760e",
      "relationship_type": "affected-organization",
      "source_ref": "incident--62af6663-ea12-5488-8a20-5145ded755b4",
      "target_ref": "identity--1a22f60d-2ab2-52fc-8dd6-b175157417ff",
      "confidence": 100,
      "external_references": [
        {
          "source_name": "BleepingComputer",
          "url": "https://www.bleepingcomputer.com/news/security/mcgraw-hill-confirms-data-breach-following-extortion-threat/",
          "external_id": "cit:d0964ac0-5141-48c1-8860-bd2f205f9cf5",
          "x_ally_stance": "supports",
          "x_ally_snapshot_id": "snp:sha256:02699cd32460bde3b21f38c4677f3a04d1f6bf3cb262bbc9ea5542a7924bbe1b"
        }
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--226f5514-e036-55aa-8d25-9ee97492c5ba",
      "created": "2026-08-09T07:53:27Z",
      "modified": "2026-08-09T07:53:27Z",
      "x_ally_original_id": "clm:4b38fe7a-8003-4efd-ab50-e7c1820e5942",
      "relationship_type": "resulted-in",
      "source_ref": "incident--62af6663-ea12-5488-8a20-5145ded755b4",
      "target_ref": "x-ally-data-exposure--a2a8bc58-28ea-5ba3-8ad3-004f56bea28f",
      "confidence": 95,
      "external_references": [
        {
          "source_name": "BleepingComputer",
          "url": "https://www.bleepingcomputer.com/news/security/mcgraw-hill-confirms-data-breach-following-extortion-threat/",
          "external_id": "cit:abb66cd6-cbb0-42e8-8b4f-09f157288c4d",
          "x_ally_stance": "supports",
          "x_ally_snapshot_id": "snp:sha256:02699cd32460bde3b21f38c4677f3a04d1f6bf3cb262bbc9ea5542a7924bbe1b"
        },
        {
          "source_name": "Have I Been Pwned",
          "url": "https://haveibeenpwned.com/api/v3/breach/McGrawHill",
          "external_id": "cit:023118d9-7c19-44bc-b4ce-323e7983ce71",
          "x_ally_stance": "supports",
          "x_ally_snapshot_id": "snp:sha256:23316cc9ae13ddaada5d336f368fc16c755b744e0fcd2a4ad4f78f3e0d0e56c6"
        }
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--340d5215-3537-5315-8dd8-67d160b7ef8b",
      "created": "2026-08-09T07:53:27Z",
      "modified": "2026-08-09T07:53:27Z",
      "x_ally_original_id": "clm:f0d23360-0e1c-451d-8686-be2e89378bd6",
      "relationship_type": "exposed-data-category",
      "source_ref": "x-ally-data-exposure--a2a8bc58-28ea-5ba3-8ad3-004f56bea28f",
      "target_ref": "x-ally-data-category--a2b7dd9d-0c02-5710-88ed-ea507d0ffa07",
      "confidence": 95,
      "external_references": [
        {
          "source_name": "Have I Been Pwned",
          "url": "https://haveibeenpwned.com/api/v3/breach/McGrawHill",
          "external_id": "cit:c089194f-e0c7-4379-92cf-e41123742d0c",
          "x_ally_stance": "supports",
          "x_ally_snapshot_id": "snp:sha256:23316cc9ae13ddaada5d336f368fc16c755b744e0fcd2a4ad4f78f3e0d0e56c6"
        }
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--53450e63-5b10-5c30-8a60-86848da13b1e",
      "created": "2026-08-09T07:53:27Z",
      "modified": "2026-08-09T07:53:27Z",
      "x_ally_original_id": "clm:3051f906-2c0c-481a-847b-c55b669765a0",
      "relationship_type": "exposed-data-category",
      "source_ref": "x-ally-data-exposure--a2a8bc58-28ea-5ba3-8ad3-004f56bea28f",
      "target_ref": "x-ally-data-category--c79f34f3-405d-57d2-8409-98eff3898231",
      "confidence": 95,
      "external_references": [
        {
          "source_name": "Have I Been Pwned",
          "url": "https://haveibeenpwned.com/api/v3/breach/McGrawHill",
          "external_id": "cit:1e59f54a-767b-40d6-a28f-28dabac39c81",
          "x_ally_stance": "supports",
          "x_ally_snapshot_id": "snp:sha256:23316cc9ae13ddaada5d336f368fc16c755b744e0fcd2a4ad4f78f3e0d0e56c6"
        }
      ]
    },
    {
      "type": "x-ally-claim",
      "spec_version": "2.1",
      "id": "x-ally-claim--1c6ce1fb-276f-556e-8c98-d46f0eea92f7",
      "created": "2026-08-09T07:53:27Z",
      "modified": "2026-08-09T07:53:27Z",
      "x_ally_original_id": "clm:b0b2293e-08f1-46da-adca-3f7b9432b6c1",
      "confidence": 100,
      "external_references": [
        {
          "source_name": "BleepingComputer",
          "url": "https://www.bleepingcomputer.com/news/security/mcgraw-hill-confirms-data-breach-following-extortion-threat/",
          "external_id": "cit:8c93fce6-3d14-4518-a8bc-d2e5d84c4f62",
          "x_ally_stance": "supports",
          "x_ally_snapshot_id": "snp:sha256:02699cd32460bde3b21f38c4677f3a04d1f6bf3cb262bbc9ea5542a7924bbe1b"
        }
      ],
      "x_ally_claim_object": {
        "kind": "value",
        "datatype": "date",
        "value": "2026-04-14"
      }
    },
    {
      "type": "x-ally-claim",
      "spec_version": "2.1",
      "id": "x-ally-claim--30ce11c0-6ca5-5b88-80df-dee04cbf0336",
      "created": "2026-08-09T07:53:27Z",
      "modified": "2026-08-09T07:53:27Z",
      "x_ally_original_id": "clm:ce47f2c3-57cf-453b-b56f-6b9dd1a5628c",
      "confidence": 100,
      "external_references": [
        {
          "source_name": "Have I Been Pwned",
          "url": "https://haveibeenpwned.com/api/v3/breach/McGrawHill",
          "external_id": "cit:6e8be722-b5ab-437c-b84f-29478a3ae054",
          "x_ally_stance": "supports",
          "x_ally_snapshot_id": "snp:sha256:23316cc9ae13ddaada5d336f368fc16c755b744e0fcd2a4ad4f78f3e0d0e56c6"
        }
      ],
      "x_ally_claim_object": {
        "kind": "value",
        "datatype": "integer",
        "value": 13500136,
        "unit": "record"
      }
    },
    {
      "type": "x-ally-claim",
      "spec_version": "2.1",
      "id": "x-ally-claim--54b6afd6-add1-5b8f-81f4-6e8c0ea193d4",
      "created": "2026-08-09T07:53:27Z",
      "modified": "2026-08-09T07:53:27Z",
      "x_ally_original_id": "clm:7330e2cb-5aa5-4a28-8ab6-f0bb5ed5efdf",
      "confidence": 100,
      "external_references": [
        {
          "source_name": "BleepingComputer",
          "url": "https://www.bleepingcomputer.com/news/security/mcgraw-hill-confirms-data-breach-following-extortion-threat/",
          "external_id": "cit:a09c381a-7498-4a9a-b988-cc259bc9b934",
          "x_ally_stance": "supports",
          "x_ally_snapshot_id": "snp:sha256:02699cd32460bde3b21f38c4677f3a04d1f6bf3cb262bbc9ea5542a7924bbe1b"
        },
        {
          "source_name": "The Record from Recorded Future News",
          "url": "https://therecord.media/mcgraw-hill-data-leak-tied-to-salesforce-misconfiguration",
          "external_id": "cit:1a5abfca-e435-4662-aed9-e2c25f6a448a",
          "x_ally_stance": "supports",
          "x_ally_snapshot_id": "snp:sha256:9dc9eb68e8a4d3b495d226cac49eb8123f5bfa1c55f635f76eaa762d27116410"
        }
      ],
      "x_ally_claim_object": {
        "kind": "value",
        "datatype": "string",
        "value": "McGraw Hill said the incident did not involve unauthorized access to its Salesforce accounts, customer databases, courseware, or internal systems."
      }
    },
    {
      "type": "x-ally-claim",
      "spec_version": "2.1",
      "id": "x-ally-claim--689dab4a-4554-5761-84b7-b409570d4432",
      "created": "2026-08-09T07:53:27Z",
      "modified": "2026-08-09T07:53:27Z",
      "x_ally_original_id": "clm:b06339ea-c580-4927-89e3-9768ed4ebef2",
      "confidence": 100,
      "external_references": [
        {
          "source_name": "The Record from Recorded Future News",
          "url": "https://therecord.media/mcgraw-hill-data-leak-tied-to-salesforce-misconfiguration",
          "external_id": "cit:b739f671-a5d0-4e16-af7d-4f328e0b718e",
          "x_ally_stance": "supports",
          "x_ally_snapshot_id": "snp:sha256:9dc9eb68e8a4d3b495d226cac49eb8123f5bfa1c55f635f76eaa762d27116410"
        }
      ],
      "x_ally_claim_object": {
        "kind": "value",
        "datatype": "string",
        "value": "McGraw Hill said it immediately secured the affected webpages after discovering the incident."
      }
    },
    {
      "type": "x-ally-claim",
      "spec_version": "2.1",
      "id": "x-ally-claim--6eab5ec2-be32-5e6c-8c1d-9a024d1722cd",
      "created": "2026-08-09T07:53:27Z",
      "modified": "2026-08-09T07:53:27Z",
      "x_ally_original_id": "clm:6c257db8-16ff-4a12-9ab9-54511133a750",
      "confidence": 100,
      "external_references": [
        {
          "source_name": "BleepingComputer",
          "url": "https://www.bleepingcomputer.com/news/security/mcgraw-hill-confirms-data-breach-following-extortion-threat/",
          "external_id": "cit:2ca2c1fa-ab02-4585-ba8d-01c2f009e48e",
          "x_ally_stance": "supports",
          "x_ally_snapshot_id": "snp:sha256:02699cd32460bde3b21f38c4677f3a04d1f6bf3cb262bbc9ea5542a7924bbe1b"
        }
      ],
      "x_ally_claim_object": {
        "kind": "value",
        "datatype": "string",
        "value": "McGraw Hill investigated with assistance from external cybersecurity experts."
      }
    },
    {
      "type": "x-ally-claim",
      "spec_version": "2.1",
      "id": "x-ally-claim--7d522678-e1f0-5adc-8d76-371493bc53f3",
      "created": "2026-08-09T07:53:27Z",
      "modified": "2026-08-09T07:53:27Z",
      "x_ally_original_id": "clm:375e9f30-5a12-47bd-a625-7cee55768b32",
      "confidence": 90,
      "external_references": [
        {
          "source_name": "Have I Been Pwned",
          "url": "https://haveibeenpwned.com/api/v3/breach/McGrawHill",
          "external_id": "cit:f8d3df12-7030-4542-921f-643219ffbfc4",
          "x_ally_stance": "supports",
          "x_ally_snapshot_id": "snp:sha256:23316cc9ae13ddaada5d336f368fc16c755b744e0fcd2a4ad4f78f3e0d0e56c6"
        }
      ],
      "x_ally_claim_object": {
        "kind": "value",
        "datatype": "string",
        "value": "HIBP reported that more than 100 GB of data across multiple files was later publicly distributed."
      }
    },
    {
      "type": "x-ally-claim",
      "spec_version": "2.1",
      "id": "x-ally-claim--857bc571-13e7-5b98-8861-983a17abef41",
      "created": "2026-08-09T07:53:27Z",
      "modified": "2026-08-09T07:53:27Z",
      "x_ally_original_id": "clm:1e78e475-a2b2-4969-8e1d-c8334d1e7725",
      "confidence": 100,
      "external_references": [
        {
          "source_name": "The Record from Recorded Future News",
          "url": "https://therecord.media/mcgraw-hill-data-leak-tied-to-salesforce-misconfiguration",
          "external_id": "cit:0d6fd009-a4be-4366-861c-9fed4c1c7f1a",
          "x_ally_stance": "supports",
          "x_ally_snapshot_id": "snp:sha256:9dc9eb68e8a4d3b495d226cac49eb8123f5bfa1c55f635f76eaa762d27116410"
        }
      ],
      "x_ally_claim_object": {
        "kind": "value",
        "datatype": "string",
        "value": "Salesforce said it had no indication that its platform was compromised and that the activity was not related to a known vulnerability in its technology."
      }
    },
    {
      "type": "x-ally-claim",
      "spec_version": "2.1",
      "id": "x-ally-claim--99596ab7-9468-530e-8adb-90dd38ed888f",
      "created": "2026-08-09T07:53:27Z",
      "modified": "2026-08-09T07:53:27Z",
      "x_ally_original_id": "clm:d158c59b-1c63-4baa-a66a-1d4e74dacad0",
      "confidence": 100,
      "external_references": [
        {
          "source_name": "BleepingComputer",
          "url": "https://www.bleepingcomputer.com/news/security/mcgraw-hill-confirms-data-breach-following-extortion-threat/",
          "external_id": "cit:f9a6c313-7c7a-4842-9e59-e921a858addb",
          "x_ally_stance": "supports",
          "x_ally_snapshot_id": "snp:sha256:02699cd32460bde3b21f38c4677f3a04d1f6bf3cb262bbc9ea5542a7924bbe1b"
        },
        {
          "source_name": "The Record from Recorded Future News",
          "url": "https://therecord.media/mcgraw-hill-data-leak-tied-to-salesforce-misconfiguration",
          "external_id": "cit:08e2b0ba-67f0-4abb-994d-5e30433da8ef",
          "x_ally_stance": "supports",
          "x_ally_snapshot_id": "snp:sha256:9dc9eb68e8a4d3b495d226cac49eb8123f5bfa1c55f635f76eaa762d27116410"
        }
      ],
      "x_ally_claim_object": {
        "kind": "value",
        "datatype": "string",
        "value": "McGraw Hill said the activity appeared to be part of a broader issue involving a misconfiguration within Salesforce's environment that affected multiple Salesforce customers."
      }
    },
    {
      "type": "x-ally-claim",
      "spec_version": "2.1",
      "id": "x-ally-claim--cd821886-3c8f-56ae-8934-6297f608d05d",
      "created": "2026-08-09T07:53:27Z",
      "modified": "2026-08-09T07:53:27Z",
      "x_ally_original_id": "clm:52fd60da-9e95-4ea1-abf9-adf76ccd5f45",
      "confidence": 80,
      "external_references": [
        {
          "source_name": "Have I Been Pwned",
          "url": "https://haveibeenpwned.com/api/v3/breach/McGrawHill",
          "external_id": "cit:bdd8acc3-ddae-4d91-aa3a-ca8bdfe64f2f",
          "x_ally_stance": "supports",
          "x_ally_snapshot_id": "snp:sha256:23316cc9ae13ddaada5d336f368fc16c755b744e0fcd2a4ad4f78f3e0d0e56c6"
        }
      ],
      "x_ally_claim_object": {
        "kind": "value",
        "datatype": "date",
        "value": "2026-04-10"
      }
    },
    {
      "type": "x-ally-claim",
      "spec_version": "2.1",
      "id": "x-ally-claim--cf291290-2e27-5ad5-8fc0-51065a526577",
      "created": "2026-08-09T07:53:27Z",
      "modified": "2026-08-09T07:53:27Z",
      "x_ally_original_id": "clm:f8fcfc72-33cf-424b-9b65-919486d54f20",
      "confidence": 100,
      "external_references": [
        {
          "source_name": "BleepingComputer",
          "url": "https://www.bleepingcomputer.com/news/security/mcgraw-hill-confirms-data-breach-following-extortion-threat/",
          "external_id": "cit:60187877-b3c4-4387-92e5-beb1d98bd4ee",
          "x_ally_stance": "supports",
          "x_ally_snapshot_id": "snp:sha256:02699cd32460bde3b21f38c4677f3a04d1f6bf3cb262bbc9ea5542a7924bbe1b"
        },
        {
          "source_name": "The Record from Recorded Future News",
          "url": "https://therecord.media/mcgraw-hill-data-leak-tied-to-salesforce-misconfiguration",
          "external_id": "cit:fa7986c5-4be8-483c-b4c8-23a89ceb1e9f",
          "x_ally_stance": "supports",
          "x_ally_snapshot_id": "snp:sha256:9dc9eb68e8a4d3b495d226cac49eb8123f5bfa1c55f635f76eaa762d27116410"
        }
      ],
      "x_ally_claim_object": {
        "kind": "value",
        "datatype": "string",
        "value": "McGraw Hill said its review found no Social Security numbers, financial account information, or student data from its educational platforms in the exposed information."
      }
    },
    {
      "type": "x-ally-claim",
      "spec_version": "2.1",
      "id": "x-ally-claim--edd17090-f557-503c-8805-1bbd3c812fcb",
      "created": "2026-08-09T07:53:27Z",
      "modified": "2026-08-09T07:53:27Z",
      "x_ally_original_id": "clm:aee5f0e3-ca9e-459c-9762-53ce80480e0e",
      "confidence": 100,
      "external_references": [
        {
          "source_name": "BleepingComputer",
          "url": "https://www.bleepingcomputer.com/news/security/mcgraw-hill-confirms-data-breach-following-extortion-threat/",
          "external_id": "cit:4d5470c0-8e5e-44cc-98c1-d29a2ea53069",
          "x_ally_stance": "supports",
          "x_ally_snapshot_id": "snp:sha256:02699cd32460bde3b21f38c4677f3a04d1f6bf3cb262bbc9ea5542a7924bbe1b"
        },
        {
          "source_name": "The Record from Recorded Future News",
          "url": "https://therecord.media/mcgraw-hill-data-leak-tied-to-salesforce-misconfiguration",
          "external_id": "cit:3b74e82a-b95d-4856-822a-dfcef856ef8d",
          "x_ally_stance": "supports",
          "x_ally_snapshot_id": "snp:sha256:9dc9eb68e8a4d3b495d226cac49eb8123f5bfa1c55f635f76eaa762d27116410"
        }
      ],
      "x_ally_claim_object": {
        "kind": "value",
        "datatype": "string",
        "value": "McGraw Hill said it identified unauthorized access to a limited set of data from a webpage hosted by Salesforce on its platform."
      }
    },
    {
      "type": "x-ally-claim",
      "spec_version": "2.1",
      "id": "x-ally-claim--f9ec46a8-333a-590a-8f93-59c425eadf2a",
      "created": "2026-08-09T07:53:27Z",
      "modified": "2026-08-09T07:53:27Z",
      "x_ally_original_id": "clm:47caf670-4f9c-4aa8-bd60-229a8410b92e",
      "confidence": 100,
      "external_references": [
        {
          "source_name": "BleepingComputer",
          "url": "https://www.bleepingcomputer.com/news/security/mcgraw-hill-confirms-data-breach-following-extortion-threat/",
          "external_id": "cit:9de17c44-a828-41c6-baaf-3c19a673cb33",
          "x_ally_stance": "supports",
          "x_ally_snapshot_id": "snp:sha256:02699cd32460bde3b21f38c4677f3a04d1f6bf3cb262bbc9ea5542a7924bbe1b"
        }
      ],
      "x_ally_claim_object": {
        "kind": "value",
        "datatype": "string",
        "value": "McGraw Hill said it was working with Salesforce to strengthen protections and fully address the issue."
      }
    },
    {
      "type": "x-ally-data-category",
      "spec_version": "2.1",
      "id": "x-ally-data-category--a2b7dd9d-0c02-5710-88ed-ea507d0ffa07",
      "created": "2026-08-08T23:12:00Z",
      "modified": "2026-08-08T23:12:00Z",
      "x_ally_original_id": "dat:559cf3f5-80c7-45ba-a930-ff0bfa8d17b0",
      "name": "Names"
    },
    {
      "type": "x-ally-data-category",
      "spec_version": "2.1",
      "id": "x-ally-data-category--c79f34f3-405d-57d2-8409-98eff3898231",
      "created": "2026-08-08T23:12:00Z",
      "modified": "2026-08-08T23:12:00Z",
      "x_ally_original_id": "dat:5abcee7e-4a37-494a-b6ba-87ff46149be9",
      "name": "Contact information"
    },
    {
      "type": "x-ally-data-exposure",
      "spec_version": "2.1",
      "id": "x-ally-data-exposure--a2a8bc58-28ea-5ba3-8ad3-004f56bea28f",
      "created": "2026-08-09T07:53:27Z",
      "modified": "2026-08-09T07:53:27Z",
      "x_ally_original_id": "exp:4c713459-60ed-490b-87d7-d4fe364463b3",
      "name": "McGraw Hill publicly distributed data corpus"
    }
  ]
}